Lyneon

How to set up DMARC (and SPF and DKIM) for your shop

Order confirmations land in spam, or Gmail says your domain is not authenticated? Three DNS records fix this in most cases. Here is how to set them up without the risk of your own e-mail being blocked.

Updated · 5 min read

In short

  • SPF lists the servers allowed to send for your domain. DKIM signs the e-mail. DMARC tells the receiver what to do when the checks fail.
  • Gmail and Yahoo (2024) and Microsoft (2025) require SPF, DKIM and DMARC from bulk senders. Without them, e-mail goes to spam.
  • Start with p=none, read the reports, then tighten. Jumping straight to p=reject can block your own mail.

Why it matters for a shop

A shop sends e-mail from several places at once: the platform sends order confirmations, the newsletter tool sends campaigns, the invoicing system sends invoices, and you answer customers from Google Workspace or Microsoft 365. All of them carry your domain in the From address. The receiver (Gmail, Outlook, Yahoo) checks whether each one is allowed to send for you.

Since February 2024, Gmail and Yahoo require senders of more than 5,000 messages a day to have valid SPF, DKIM and DMARC and one-click unsubscribe. Microsoft introduced similar rules for Outlook in May 2025. Even if you send far less, missing authentication is a strong spam signal. And without DMARC anyone can send fraudulent e-mail that looks like it comes from your shop.

The three records in plain words

  • SPF (Sender Policy Framework): one TXT record on the domain listing the services allowed to send. The receiver compares the sending server with the list.
  • DKIM (DomainKeys Identified Mail): each service signs its e-mail. You publish the public key in DNS, and the receiver uses it to confirm nobody changed the message.
  • DMARC: a _dmarc record that says what to do with mail that passes neither SPF nor DKIM for a matching domain, and where to send reports.

The key word is alignment. DMARC passes only when the domain checked by SPF or DKIM matches the domain in the From address. A newsletter sent through a third-party service signed with that service’s own DKIM domain fails DMARC, even though SPF and DKIM technically “passed”.

Setup, step by step

You add the records where your domain’s DNS is managed: your registrar, your host or Cloudflare. Changes usually apply within an hour, at most within two days.

  1. List everything that sends

    Write down every service that sends e-mail with your domain: the shop platform, mailboxes (Google Workspace, Microsoft 365, hosting mailboxes), the newsletter tool (Klaviyo, Mailchimp, Brevo and others), invoicing, helpdesk or chat. A forgotten service is where setups break.

  2. Check your current records

    Run nslookup -type=txt yourdomain.com and nslookup -type=txt _dmarc.yourdomain.com, or open the DNS records at your registrar. Look for a record starting with v=spf1. There must be only one; two SPF records mean SPF fails entirely.

  3. Set one SPF record

    Combine all services in one TXT record on the main domain. Each service documents its own include. Example for Google Workspace and one newsletter service:

    yourdomain.com.  TXT  "v=spf1 include:_spf.google.com include:spf.newsletter-service.example ~all"

  4. Watch the ten-lookup limit

    SPF may make at most ten DNS lookups when evaluated. Each include counts, nested ones too. Five or six services can exceed the limit, and SPF then fails. Online SPF checkers show the count. Never use +all, which allows anyone to send.

  5. Turn on DKIM in every service

    In each service find the custom domain or domain authentication settings. The service gives you one to three records (CNAME or TXT) named like selector._domainkey.yourdomain.com. Add them to DNS and confirm in the service.

  6. Add DMARC in monitoring mode

    Create a TXT record named _dmarc. The value p=none blocks nothing; it only turns on reports. Put the mailbox for reports in rua; expect daily reports from the large providers.

    _dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

  7. Read reports for two to four weeks

    Reports are XML files that are hard to read. Use a free DMARC report analyser that turns them into a summary. Look for services that send for your domain and fail. Either add them to SPF and DKIM, or they are fraud.

  8. Tighten in steps

    When all your services pass, change the policy to p=quarantine (failing mail goes to spam). You can start with pct=25, a quarter of the mail. After more weeks without problems, move to p=reject.

    _dmarc.yourdomain.com.  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com"

  9. Confirm on a real e-mail

    Place a test order to a Gmail address. On the received message open the menu (three dots) and Show original. At the top you must see SPF: PASS, DKIM: PASS and DMARC: PASS. Repeat with a newsletter and an invoice.

The most common mistakes

  • Two SPF records, because every service’s guide says “add a record”. The right way is one record with all includes.
  • DKIM not turned on in the newsletter tool. Campaigns then fail DMARC because the domains do not align.
  • Going straight to p=reject with no monitoring. Invoices or platform e-mails stop arriving.
  • Reports sent to a personal inbox that they flood. Use a separate address.
  • Records only on the main domain while mail is sent from a subdomain such as mail.yourdomain.com.

Frequently asked questions

Can DMARC stop my own e-mail?

Not with p=none, which only collects reports. The risk starts with p=quarantine or p=reject if a service fails. That is why we tighten in steps, guided by the reports.

How much does it cost and how long does it take?

The records themselves are free at every registrar. Setup takes a few hours; monitoring reports before tightening takes two to four weeks.

Do I need DMARC if I send only a few e-mails a day?

Yes. The 5,000-a-day threshold applies to Gmail’s strict rules, but authentication improves delivery for every sender and stops others from abusing your domain for fraud.

Order a free audit

Enter the shop address and your e-mail. We send the report in two working days. We use your details only to answer this request.

  • No access and nothing to install
  • The report is yours even if you order nothing
  • A person answers, not a bot

We use your details only to answer this request. Privacy policy

More guides